<?xml version="1.0" encoding="UTF-8"?>
<!-- Copyright 2016-2017 by floragunn GmbH - All rights reserved Unless required 
	by applicable law or agreed to in writing, software distributed here is distributed 
	on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either 
	express or implied. -->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <parent>
    <groupId>com.floragunn</groupId>
    <artifactId>search-guard-flx-parent</artifactId>
    <version>4.1.2-es-8.19.18</version>
  </parent>

  <artifactId>dlic-search-guard-flx-security</artifactId>
  <packaging>jar</packaging>
  <name>Search Guard FLX: Security (Enterprise)</name>

  <properties>
    <jjwt.version>0.13.0</jjwt.version>
    <ldaptive.version>2.3.2</ldaptive.version>

    <unboundid-ldapsdk.version>7.0.4</unboundid-ldapsdk.version>
  </properties>

  <dependencies>

    <dependency>
      <groupId>com.flipkart.zjsonpatch</groupId>
      <artifactId>zjsonpatch</artifactId>
      <version>0.4.16</version>
      <exclusions>
        <exclusion>
          <groupId>com.fasterxml.jackson.core</groupId>
          <artifactId>jackson-core</artifactId>
        </exclusion>
        <exclusion>
          <groupId>com.fasterxml.jackson.core</groupId>
          <artifactId>jackson-databind</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <dependency>
      <groupId>com.jayway.jsonpath</groupId>
      <artifactId>json-path</artifactId>
      <exclusions>
        <exclusion>
          <groupId>net.minidev</groupId>
          <artifactId>json-smart</artifactId>
        </exclusion>
        <exclusion>
          <groupId>org.ow2.asm</groupId>
          <artifactId>asm</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <dependency>
      <groupId>com.onelogin</groupId>
      <artifactId>java-saml</artifactId>
      <version>2.9.0</version>

      <exclusions>
        <exclusion>
          <groupId>org.codehaus.woodstox</groupId>
          <artifactId>woodstox-core-asl</artifactId>
        </exclusion>
        <exclusion>
          <groupId>joda-time</groupId>
          <artifactId>joda-time</artifactId>
        </exclusion>
        <exclusion>
          <groupId>org.apache.commons</groupId>
          <artifactId>commons-lang3</artifactId>
        </exclusion>
        <exclusion>
          <!-- Exclusion because the dependent version has vulnerable dependencies. Replaced by explicit dependency just below.  -->
          <groupId>org.apache.santuario</groupId>
          <artifactId>xmlsec</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <dependency>
      <groupId>org.apache.commons</groupId>
      <artifactId>commons-lang3</artifactId>
      <!-- replacement for exclusion from com.onelogin:java-saml -->
    </dependency>

    <dependency>
      <groupId>com.unboundid</groupId>
      <artifactId>unboundid-ldapsdk</artifactId>
      <version>${unboundid-ldapsdk.version}</version>
    </dependency>

    <dependency>
      <groupId>commons-codec</groupId>
      <artifactId>commons-codec</artifactId>
    </dependency>
    <dependency>
      <groupId>commons-collections</groupId>
      <artifactId>commons-collections</artifactId>
    </dependency>

    <dependency>
      <groupId>joda-time</groupId>
      <artifactId>joda-time</artifactId>
    </dependency>

    <dependency>
      <groupId>org.apache.cxf</groupId>
      <artifactId>cxf-rt-rs-security-jose</artifactId>
      <version>${cxf.version}</version>
      <exclusions>
        <exclusion>
          <groupId>org.glassfish.jaxb</groupId>
          <artifactId>jaxb-runtime</artifactId>
        </exclusion>
        <exclusion>
          <groupId>jakarta.xml.bind</groupId>
          <artifactId>jakarta.xml.bind-api</artifactId>
        </exclusion>
        <exclusion>
          <groupId>com.fasterxml.woodstox</groupId>
          <artifactId>woodstox-core</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <dependency>
      <groupId>org.apache.httpcomponents</groupId>
      <artifactId>httpclient-cache</artifactId>
      <version>${http.commons.version}</version>
      <exclusions>
        <exclusion>
          <groupId>org.apache.httpcomponents</groupId>
          <artifactId>httpcore</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
    <dependency>
      <!-- Replacement dependency for com.onelogin:java-saml (see above) -->
      <groupId>org.apache.santuario</groupId>
      <artifactId>xmlsec</artifactId>
      <version>4.0.4</version>
    </dependency>
    <dependency>
      <groupId>org.bouncycastle</groupId>
      <artifactId>bcpkix-jdk18on</artifactId>
    </dependency>

    <dependency>
      <groupId>org.opensaml</groupId>
      <artifactId>opensaml-saml-impl</artifactId>
      <version>${opensaml.version}</version>
      <exclusions>
        <exclusion>
          <groupId>org.springframework</groupId>
          <artifactId>spring-jcl</artifactId>
        </exclusion>
        <exclusion>
          <groupId>commons-collections</groupId>
          <artifactId>commons-collections</artifactId>
        </exclusion>
        <exclusion>
          <groupId>org.apache.httpcomponents</groupId>
          <artifactId>httpclient</artifactId>
        </exclusion>
        <exclusion>
          <!-- Bouncy Castle is configured globally -->
          <groupId>org.bouncycastle</groupId>
          <artifactId>bcprov-jdk18on</artifactId>
        </exclusion>
        <exclusion>
          <!-- Bouncy Castle is configured globally -->
          <groupId>org.bouncycastle</groupId>
          <artifactId>bcpkix-jdk18on</artifactId>
        </exclusion>
        <exclusion>
          <!-- Version overridden explicitly below to satisfy WireMock 3.13.2 -->
          <groupId>org.apache.httpcomponents.client5</groupId>
          <artifactId>httpclient5</artifactId>
        </exclusion>
        <exclusion>
          <!-- Version overridden explicitly below to satisfy WireMock 3.13.2 -->
          <groupId>org.apache.httpcomponents.core5</groupId>
          <artifactId>httpcore5</artifactId>
        </exclusion>
        <exclusion>
          <!-- Version overridden explicitly below to satisfy WireMock 3.13.2 -->
          <groupId>org.apache.httpcomponents.core5</groupId>
          <artifactId>httpcore5-h2</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
    <dependency>
      <groupId>com.floragunn</groupId>
      <artifactId>search-guard-flx-security</artifactId>
      <scope>provided</scope>
    </dependency>

    <dependency>
      <groupId>com.floragunn</groupId>
      <artifactId>search-guard-flx-ssl</artifactId>
      <scope>provided</scope>
    </dependency>

    <dependency>
      <groupId>com.floragunn</groupId>
      <artifactId>search-guard-flx-support</artifactId>
      <scope>provided</scope>
    </dependency>

    <dependency>
      <groupId>com.floragunn</groupId>
      <artifactId>dlic-search-guard-flx-dlsfls</artifactId>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>io.jsonwebtoken</groupId>
      <artifactId>jjwt-api</artifactId>
      <version>${jjwt.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>io.jsonwebtoken</groupId>
      <artifactId>jjwt-impl</artifactId>
      <version>${jjwt.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>io.jsonwebtoken</groupId>
      <artifactId>jjwt-jackson</artifactId>
      <version>${jjwt.version}</version>
      <scope>test</scope>
      <exclusions>
        <exclusion>
          <groupId>com.fasterxml.jackson.core</groupId>
          <artifactId>jackson-databind</artifactId>
        </exclusion>
      </exclusions>
    </dependency>

    <dependency>
      <groupId>javax.servlet</groupId>
      <artifactId>servlet-api</artifactId>
      <version>2.5</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>net.minidev</groupId>
      <artifactId>json-smart</artifactId>
      <version>2.6.0</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>org.awaitility</groupId>
      <artifactId>awaitility</artifactId>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>org.wiremock</groupId>
      <artifactId>wiremock</artifactId>
      <scope>test</scope>
    </dependency>

    <!--
      Force Apache HttpClient5 and HttpCore5 to versions required by WireMock 3.13.2.

      Problem: OpenSAML 5.2.1 (via shib-networking) pulls in httpclient5:5.3.1 and
      httpcore5:5.2.5. WireMock 3.13.2 was compiled against httpclient5:5.5.1 which
      requires httpcore5:5.3.6. Maven's nearest-wins rule picks the older OpenSAML
      versions, causing:
        - NoSuchMethodError on RequestConfig.Builder.setProtocolUpgradeEnabled()
          (added in httpclient5 5.4+)
        - NoClassDefFoundError on ManagedHttpClientConnectionFactory initialization
          (httpclient5 5.5.1 classes depend on httpcore5 5.3.6 APIs)

      Fix: declare httpclient5 5.5.1, httpcore5 5.3.6, and httpcore5-h2 5.3.6 as
      direct compile-scope dependencies so they win version mediation at depth 1.
      Compile scope is required because SamlHTTPMetadataResolver uses httpclient5
      classes in production code — a test-scoped override would suppress the transitive
      versions but leave the compile classpath without them.

      Note: the version numbers differ (5.5.1 vs 5.3.6) because httpclient5 and
      httpcore5 are separate Apache projects with independent version schemes.
      httpclient5:5.5.1 was built against httpcore5:5.3.6 — these are the matching
      versions as declared in the httpclient5-parent:5.5.1 POM.
    -->
    <dependency>
      <groupId>org.apache.httpcomponents.client5</groupId>
      <artifactId>httpclient5</artifactId>
      <version>5.6.1</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.apache.httpcomponents.core5</groupId>
      <artifactId>httpcore5</artifactId>
      <version>5.4.2</version>
      <scope>compile</scope>
    </dependency>
    <dependency>
      <groupId>org.apache.httpcomponents.core5</groupId>
      <artifactId>httpcore5-h2</artifactId>
      <version>5.4.2</version>
      <scope>compile</scope>
    </dependency>

    <dependency>
      <groupId>com.floragunn</groupId>
      <artifactId>search-guard-flx-security</artifactId>
      <classifier>tests</classifier>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>com.floragunn</groupId>
      <artifactId>search-guard-flx-support</artifactId>
      <classifier>tests</classifier>
      <scope>test</scope>
    </dependency>
    

    <dependency>
      <groupId>com.floragunn</groupId>
      <artifactId>search-guard-flx-legacy-test-framework</artifactId>
      <classifier>tests</classifier>
      <scope>test</scope>
    </dependency>
    

  </dependencies>
</project>
